Login Request a demo
TE
Vendor
Terra-master
4 products with CVEs on record
48
CVEs
1
On KEV
0
New 30D
Products
TO
Terramaster Operating System
Terra-master
9.8
28 CVEs1 on KEV0 new
TO
Tos
Terra-master
9.8
15 CVEs0 on KEV0 new
FF
Fs-210 Firmware
Terra-master
7.5
3 CVEs0 on KEV0 new
FF
F2-210 Firmware
Terra-master
8.8
2 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2024-34539
TO
Tos
Terra-master
9.4
1%
Jun 14Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server
CVE-2022-24989
TO
Terramaster Operating System
Terra-master
9.8
32%
Aug 20TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the…
CVE-2022-24990
RansomwareIn wildKEV
TO
Terramaster Operating System
Terra-master
7.5
83%
Feb 7TerraMaster OS Remote Command Execution Vulnerability
CVE-2021-45842
TO
Tos
Terra-master
7.5
2%
Apr 25It is possible to obtain the first administrator's hash set up in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) on the system as well as other information such as MAC…
CVE-2021-45841
TO
Tos
Terra-master
8.1
8%
Apr 25In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's password hash
CVE-2021-45840
TO
Tos
Terra-master
9.8
4%
Apr 25It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending specifically crafted input to…
CVE-2021-45839
TO
Tos
Terra-master
6.5
10%
Apr 25It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as well as other information such as MAC…
CVE-2021-45837
TO
Tos
Terra-master
9.8
16%
Apr 25It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /tos/index.php?app/del
CVE-2021-45836
TO
Tos
Terra-master
8.8
2%
Apr 25An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by injecting a maliciously crafted input in the…
CVE-2021-30127
FF
F2-210 Firmware
Terra-master
7.3
1%
Apr 3TerraMaster F2-210 devices through 2021-04-03 use UPnP to make the admin web server accessible over the Internet on TCP port 8181, which is arguably inconsistent with the "It is…
CVE-2020-15568
TO
Tos
Terra-master
9.8
29%
Jan 30TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root
CVE-2020-29189
TO
Tos
Terra-master
8.1
2%
Dec 24Incorrect Access Control vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full access to any folder…
CVE-2020-28190
TO
Tos
Terra-master
5.9
1%
Dec 24TerraMaster TOS <= 4.2.06 was found to check for updates (of both system and applications) via an insecure channel (HTTP)
CVE-2020-28188
TO
Tos
Terra-master
9.8
96%
Dec 24Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter
CVE-2020-28187
TO
Tos
Terra-master
9.8
16%
Dec 24Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read, edit or delete any file within the filesystem via the (1)…
CVE-2020-28186
TO
Tos
Terra-master
7.3
4%
Dec 24Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover
CVE-2020-28185
TO
Tos
Terra-master
5.3
18%
Dec 24User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to…
CVE-2020-28184
TO
Tos
Terra-master
5.4
1%
Dec 24Cross-site scripting (XSS) vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to…
CVE-2020-35665
TO
Terramaster Operating System
Terra-master
9.8
78%
Dec 23An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV…
CVE-2019-18195
FF
F2-210 Firmware
Terra-master
8.8
2%
Oct 28An issue was discovered on TerraMaster FS-210 4.0.19 devices
CVE-2019-18385
FF
Fs-210 Firmware
Terra-master
7.5
2%
Oct 23An issue was discovered on TerraMaster FS-210 4.0.19 devices
CVE-2019-18384
FF
Fs-210 Firmware
Terra-master
6.5
1%
Oct 23An issue was discovered on TerraMaster FS-210 4.0.19 devices
CVE-2019-18383
FF
Fs-210 Firmware
Terra-master
7.5
2%
Oct 23An issue was discovered on TerraMaster FS-210 4.0.19 devices
CVE-2018-13418
TO
Terramaster Operating System
Terra-master
8.8
5%
Nov 27System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter
CVE-2018-13361
TO
Terramaster Operating System
Terra-master
5.3
17%
Nov 27User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter
CVE-2018-13360
TO
Terramaster Operating System
Terra-master
6.1
1%
Nov 27Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter
CVE-2018-13359
TO
Terramaster Operating System
Terra-master
8.8
20%
Nov 27Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter
CVE-2018-13358
TO
Terramaster Operating System
Terra-master
8.8
25%
Nov 27System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter
CVE-2018-13357
TO
Terramaster Operating System
Terra-master
5.4
1%
Nov 27Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names
CVE-2018-13356
TO
Terramaster Operating System
Terra-master
8.8
2%
Nov 27Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions
CVE-2018-13355
TO
Terramaster Operating System
Terra-master
6.5
1%
Nov 27Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization
CVE-2018-13354
TO
Terramaster Operating System
Terra-master
9.8
23%
Nov 27System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter
CVE-2018-13353
TO
Terramaster Operating System
Terra-master
8.8
6%
Nov 27System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter
CVE-2018-13352
TO
Terramaster Operating System
Terra-master
7.5
2%
Nov 27Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session tokens in a world-readable directory
CVE-2018-13351
TO
Terramaster Operating System
Terra-master
4.8
1%
Nov 27Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form
CVE-2018-13350
TO
Terramaster Operating System
Terra-master
9.8
17%
Nov 27SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter
CVE-2018-13349
TO
Terramaster Operating System
Terra-master
6.1
1%
Nov 27Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the user's username
CVE-2018-13338
TO
Terramaster Operating System
Terra-master
9.8
10%
Nov 27System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation
CVE-2018-13336
TO
Terramaster Operating System
Terra-master
9.8
9%
Nov 27System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd" parameter during user creation
CVE-2018-13335
TO
Terramaster Operating System
Terra-master
5.4
1%
Nov 27Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders via their descriptions
CVE-2018-13333
TO
Terramaster Operating System
Terra-master
6.1
1%
Nov 27Cross-site scripting in File Manager in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript in the permissions window by placing JavaScript in users' usernames
CVE-2018-13332
TO
Terramaster Operating System
Terra-master
7.5
2%
Nov 27Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to arbitrary locations via the "path" URL parameter
CVE-2018-13331
TO
Terramaster Operating System
Terra-master
6.1
1%
Nov 27Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing users by placing JavaScript in their usernames
CVE-2018-13330
TO
Terramaster Operating System
Terra-master
7.2
8%
Nov 27System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname" parameter
CVE-2018-13337
TO
Terramaster Operating System
Terra-master
5.4
1%
Nov 27Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript
CVE-2018-13334
TO
Terramaster Operating System
Terra-master
6.1
1%
Nov 27Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "options[sysname]" parameter
CVE-2018-13329
TO
Terramaster Operating System
Terra-master
6.1
1%
Nov 27Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "lines" URL parameter
CVE-2017-9328
TO
Terramaster Operating System
Terra-master
9.8
7%
Sep 15Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root